django page got hacked - how to react? - django

Question

my original page is http://www.stahlbaron.de/
since 2 days, http://www.joma-topflex.ru/ is pointing to my page. I realized this and added ALLOWED_HOSTS = ['.stahlbaron.de'], but didnot help. the bad URL still pointing to my page.
what can I do? I used nginx, uwsgi to deploy the page. Ngix doesnot have deny www.joma-topflex.ru; option unfortunately.

Answer 1

There are two possibilities:
The owner of the copy actually stole your code and the database, which is unlikely. This can be easily checked — just add a change to some page on your website and see if it appears on the doppelgaenger. If the copy is independent then nothing will change there. Don't forget to use Ctrl+F5 to avoid seeing cached contents.
If this is the case, you can report abuse to the copy's hosting provider. In fact, you should do it in any case.
If that copy is just a proxied mirror to your website, blocking its IP will solve the problem. You can do it in Nginx by modifying your configuration like this:
geo $bad_client {
default 0;
78.47.49.3/32 1;
}
server {
...
if ($bad_client) {
return 403;
}
add_header X-Frame-Options SAMEORIGIN;
...
}
This is also a good idea to set the header X-Frame-Options to SAMEORIGIN (see the example above), which guarantees that nobody will make a copy of your site on another domain using an iframe.
EDIT:
And now this just gets funny. What happens here is this: some (probably long) time ago someone bought a hosting package from Hetzner, registered the domain www.joma-topflex.ru and pointed it to the IP that Hetzner had given him or her. And that IP was, as you might have guessed by now, 78.47.49.3.
After a while this person probably lost interest to the project and stopped paying to Hetzner. Hetzner, in turn, reassigned the IP to the new client — you. But the domain name www.joma-topflex.ru had never been pointed to another IP by the domain's owner, which often happens to abandoned projects.
So, there is actually no bad guy here. The owner of www.joma-topflex.ru likely doesn't even know that his domain works once again.
The real problem here is your Nginx configuration, which proxies any request to your server to your Django application. What you need to do is explicitly set your domain as the only acceptable server name like this:
server {
# Delete any other server_name you find around and add this:
server_name www.stahlbaron.de;
...
}
The funny part is, you can use domain www.joma-topflex.ru as long as it points to your server. For example, you can add another server block to your Nginx configuration, set directive server_name with "www.joma-topflex.ru" and use it for another Django application, or whatever else you like.
EDIT 2:
Incidentally, the domain joma-topflex.ru is paid till 2015.04.26 and most likely will not be prolonged. In other words, you can even do nothing and the problem will solve itself in two days.